mirrors/php-src
0
0
Fork 0
mirror of https://github.com/php/php-src.git synced 2024-11-24 10:24:11 +08:00
Code Issues Packages Projects Releases Wiki Activity

Fixed bug #43851 (Memory corrution on reuse of assigned value)

Browse Source
This commit is contained in:
Dmitry Stogov 2008-01-15 11:52:45 +00:00
parent ba8acfdfdf
commit e6588b6620
2 changed files with 16 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
Zend/tests/bug43851.phpt Normal file
View File

@ -0,0 +1,13 @@
--TEST--
Bug #43851 (Memory corrution on reuse of assigned value)
--FILE--
<?php
foo();
function foo() {
global $LAST;
($LAST = $LAST + 0) * 1;
echo "ok\n";
}
?>
--EXPECT--
ok

6
Zend/zend_execute.c
View File

@ -693,7 +693,7 @@ static inline zval* zend_assign_to_variable(zval **variable_ptr_ptr, zval *value
if (Z_TYPE_P(variable_ptr) == IS_OBJECT && Z_OBJ_HANDLER_P(variable_ptr, set)) {
Z_OBJ_HANDLER_P(variable_ptr, set)(variable_ptr_ptr, value TSRMLS_CC);
return value;
return variable_ptr;
}
if (EG(ze1_compatibility_mode) && Z_TYPE_P(value) == IS_OBJECT) {
@ -722,7 +722,7 @@ static inline zval* zend_assign_to_variable(zval **variable_ptr_ptr, zval *value
Z_DELREF_P(value);
}
zendi_zval_dtor(garbage);
return value;
return variable_ptr;
}
} else {
if (variable_ptr != value) {
@ -760,7 +760,7 @@ static inline zval* zend_assign_to_variable(zval **variable_ptr_ptr, zval *value
Z_DELREF_P(value);
}
zendi_zval_dtor(garbage);
return value;
return variable_ptr;
}
} else {
if (Z_DELREF_P(variable_ptr)==0) {